Authenticate an HTTP session
Authenticate an HTTP session
Use @nostr-wot/auth on your server and /client in the browser. Mount the four routes shown below, then call loginWithSigner from a user action. This creates a server session using a kind-27235 NIP-98 event.
terminal
$npm install @nostr-wot/auth@5.0.0 nostr-wot-sdk@3.0.0 nostr-tools
Example
typescript
// Server only: lib/auth.ts
import { createAuthService } from "@nostr-wot/auth";
import { createNextHandlers } from "@nostr-wot/auth/next";
const secret = process.env.NOSTR_AUTH_SECRET;
if (!secret) throw new Error("Configure NOSTR_AUTH_SECRET on the server");
export const handlers = createNextHandlers(createAuthService({
secret, expectedVerifyUrl: "https://example.com/api/auth/verify",
jwtIssuer: "https://example.com", jwtTtlSec: 3600,
}), { cookie: true, cookieAttrs: { secure: true, sameSite: "Lax" } });
// Each export belongs in its own Next.js route.ts file:
// app/api/auth/challenge/route.ts: export const POST = handlers.challenge;
// app/api/auth/verify/route.ts: export const POST = handlers.verify;
// app/api/auth/me/route.ts: export const GET = handlers.me;
// app/api/auth/logout/route.ts: export const POST = handlers.logout;
// Import { handlers } from "@/lib/auth" in each route.
// Separate browser module, called by a login button:
// import { loginWithSigner } from "@nostr-wot/auth/client";
// import { Nip07Signer } from "nostr-wot-sdk/signers";
// await loginWithSigner({ baseUrl: "/api/auth", signer: new Nip07Signer() });Integration notes
Replace example.com with the exact production origin and verification URL. Generate a strong random server secret and never expose it through NEXT_PUBLIC variables. Check the session and application permissions on protected routes. The default challenge is stateless: strict one-time use requires a consume-once store. Kind 22242 is relay authentication, not HTTP login.